Download presentation

Presentation is loading. Please wait.

Published byYuliana Holloway Modified over 2 years ago

1
Quantum Information and the PCP Theorem Ran Raz Weizmann Institute

2
PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by a poly- size proof that can be verified by reading only O(1) of its bits

3
PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by poly(n) blocks of length O(1) that can be verified by reading only 2 blocks

4
Same with one block is impossible (under hardness assumptions) even if each block is of almost linear size

5
x 2 SAT can be proved by 1) a log-size quantum state | i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring | i the verifier needs to read only one block of p

6
Part I: The Information of a Quantum State

7
Information of a Quantum State: A quantum state | i of n qubits is described by 2 n complex numbers. However, a measurement only gives n bits of information about | i (and the rest is lost) How much of the information in | i can be used ?

8
Holevo’s Theorem (1973): If Bob encodes a 1,..,a n by | i s.t. Alice can retrieve a 1,..,a n from | i then | i is a state of ¸ n qubits. If Alice retrieves each bit a i with prob 1- then | i is a state of ¸ [1-H( )] ¢ n qubits We can’t communicate n bits by sending less than n qubits

9
ANTV-Nayak’s Theorem (1999): If Bob encodes a 1,..,a n by | i s.t. 8 i Alice can retrieve a i from | i then | i is a state of ¸ n qubits. If Alice can retrieve each bit a i with prob 1- then | i is a state of ¸ [1-H( )] ¢ n qubits Holevo’s: Alice retrieves a 1,..,a n Nayak’s: Alice retrieves only one a i (of her choice)

10
Our Result: Bob can encode N=2 n bits a 1,..,a N by a state | i of O(n) qubits, s.t. 8 i, a i can be retrieved from | i by a (one round) Arthur-Merlin interactive protocol of size poly(n) (with a third party, Merlin) (classical messages) (polynomially small error)

11
Retrieving a i from | i : Alice measures | i (gets result e) and sends a question q=q(i,e) Merlin answers by r. Alice computes V(i,e,r) 2 {0,1,err} Completeness: 8 i,q 9 r, V(i,e,r) = a i Soundness: 8 i,q,r, V(i,e,r) 2 {a i,err} (with high probability) (q,r are poly(n) classical bits)

12
Retrieving a i from | i : Alice measures | i (gets result e) and sends a question q=q(i,e) Merlin answers by r. Alice computes V(i,e,r) 2 {0,1,err} Completeness: 8 i,q 9 r, V(i,e,r) = a i Soundness: 8 i,q,r, V(i,e,r) 2 {a i,err} (with high probability) (q,r are poly(n) classical bits) Bob is trustworthy (| i is correct) Merlin knows a 1,..,a N

13
More Generally: 1) Any constant number of elements from a 1,..,a N can be retrieved in the same way, by a protocol of size poly(n) 2) Any k elements can be retrieved by a protocol of size k ¢ poly(n) 3) Each a i can be 2 {1,..,N}

14
A Dequantumized Protocol: | i is not needed: Bob can send a (poly-size) random secret classical string , If Merlin doesn’t know The protocol works as before

15
Part II: The Retrieval Protocol

16
Multilinear Extension: Given a 0,..,a N (N=2 n -1) F = field of size n 2 A: F n ! F, s.t.: 1) 8 i 2 {0,1} n, A(i) = a i 2) A is multilinear (deg(A) · n)

17
Quantum Multilinear Extension: A= multilinear extension of a 0,..,a N 1) | i is a state of poly(n) qubits 2) When Alice measures | i, she gets z,A(z) for a random z 2 F n (Merlin doesn’t know z)

18
Retrieving A(i): Alice knows A(z) and wants A(i) l = the line through i,z (in F n ) A l : l ! F = restriction of A to l (deg(A l ) · n)

19
The Protocol: Alice sends l, Merlin is required to give A l : l ! F. Merlin answers by g : l ! F (deg(g) · n) If g(z) A l (z) Alice rejects Otherwise, Alice assumes A(i)=g(i) If g A l then w.h.p. g(z) A l (z) (since both are low degree) Otherwise, A(i) is correct

20
A Dequantumized Protocol: | i is not needed: Bob can send z,A(z), for a random z 2 F n (s.t., Merlin doesn’t know z) The protocol works as before

21
Part III: The Exceptional Power of QIP/qpoly

22
The Class QIP/qpoly: IP: [B][GMR] x 2 L can be proved by a poly-size interactive proof QIP: [Wat] x 2 L can be proved by a poly-size quantum interactive proof QIP/qpoly: x 2 L can be proved by a poly-size quantum interactive proof with poly-size quantum advice

23
Quantum Advice: (captures quantum non-uniformity) A (poly-size) quantum state | L,n i given to the verifier as an advice Alternatively, the verifier is a quantum circuit with working space initiated with | L,n i [NY],[Aar]: Limitations on BQP/qpoly

24
QIP/qpoly: QIP/qpoly: x 2 L can be proved by a poly-size interactive proof where the verifier is a poly-size quantum circuit with working space initiated with an arbitrary state | L,n i Our Result: QIP/qpoly contains all languages

25
Proof: Denote a i 2 {0,1}, a i =1 iff i 2 L | L,n i = the quantum multilinear extension of a 0,..,a N (N=2 n -1) a i can be retrieved from | L,n i by Arthur-Merlin interactive protocol of size poly(n) (one round, classical communication)

26
Randomized Advice: A (poly-size) random string , chosen from a distribution D L,n, and given to the verifier as an advice Alternatively, the verifier is a distribution over poly-size classical circuits

27
Randomized Advice: A (poly-size) random string , chosen from a distribution D L,n, and given to the verifier as an advice Alternatively, the verifier is a distribution over poly-size classical circuits IP/rpoly: x 2 L can be proved by a poly-size interactive proof where the verifier is a distribution over poly-size classical circuits IP/rpoly contains all languages

28
Part IV: Quantum Versions of the PCP Theorem

29
PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by a poly- size proof that can be verified by reading only O(1) of its bits

30
PCP Thm [BFL,FGLSS,AS,ALMSS]: x 2 SAT can be proved by poly(n) blocks of length O(1) that can be verified by reading only 2 blocks

31
Same with one block is impossible (under hardness assumptions) even if each block is of almost linear size

32
We Show: x 2 SAT can be proved by 1) a log-size quantum state | i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring | i the verifier needs to read only one block of p

33
We Show: x 2 SAT can be proved by 1) a log-size quantum state | i and 2) a classical proof p of poly(n) blocks of length polylog each s.t., after measuring | i the verifier needs to read only one block of p

34
Naive Attempt: a 1,..,a N = classical PCP (N=poly(n)) | i = quantum multilinear extension of a 1,..,a N O(log N) qubits p = Merlin’s answers in the retrieval protocol The verifier retrieves a constant number of bits by reading one block

35
Problem: The verifier can’t trust that | i is a quantum multilinear extension In the settings of communication or quantum advice, the verifier could trust that | i is correct. In the setting of PCP, | i can be anything e.g. | i is concentrated on a point

36
Quantum Low Degree Test: The verifier checks that | i is a quantum encoding of a low degree polynomial. This is done with the aid of the classical proof (or equivalently, a classical prover)

37
Problem: We are only allowed one query How can we do both: quantum low degree test and retrieval of bits We combine the two tasks using ideas from [DFKRS]

38
Part V: Scaling up to NEXP

39
Our Result (for L 2 NEXP): x 2 L can be proved by 1) a poly-size quantum state | i 2) a classical proof p of exp(n) blocks of length poly each s.t., after measuring | i the verifier needs to read only one block of p

40
Our Result (for L 2 NEXP): x 2 L can be proved by 1) a poly-size quantum state | i 2) a classical proof p of exp(n) blocks of length poly each s.t., after measuring | i the verifier needs to read only one block of p

41
Alternatively (for L 2 NEXP): x 2 L has a 3 messages (MAM) interactive proof, where the prover is quantum in round 1 and classical in round 2: 1) Prover sends | i 2) Verifier sends q 3) Prover answers p(q)

42
Models of 3 Messages Proofs: IP(3): prover is classical QIP(3): prover is quantum The hybrid model: HIP(3): prover is quantum in first round and classical in second

43
Models of 3 Messages Proofs: IP(3): prover is classical QIP(3): prover is quantum The hybrid model: HIP(3): prover is quantum in first round and classical in second IP(3) µ IP µ PSPACE QIP(3) µ QIP µ EXP [KW] Our result: HIP(3) = NEXP

44
Why the prover in our protocol can’t be quantum in both rounds ? A quantum prover can answer in round 2, based on a measurement of a state entangled to the state given in round 1 (fancy version of the EPR paradox)

45
The End

Similar presentations

© 2017 SlidePlayer.com Inc.

All rights reserved.

Ads by Google